DevSecOps › Module 4 › Lesson 4
Lab — SAST
Pack SAST named, Gitleaks named, and secret hygiene cards — SAST file from $DEVSEC_LAB only.
Visual · t36_sast_lab
Lab: SAST and secrets pack. $DEVSEC_LAB only. Original Cyberlium.
Opening
SAST pack merges static analysis to secrets to hygiene — paperwork before DAST module.
Lessons 4-1–4-3 named SAST, Gitleaks, and secret hygiene. This lab merges three sections into one $DEVSEC_LAB SAST artifact with M1 ethics and M3 pipeline cross-references. No stranger-org scans or live credential dumps — SAST and secrets paperwork only. Next: Quiz — SAST and Secrets.
1. Lab contract: SAST and secrets pack
Create $HOME/cyberlium-lab/t36-m04-l04-sast-lab.txt merging SAST named, Gitleaks named, and secret hygiene sections with $DEVSEC_LAB fictional repo and M1/M3 cross-references.
Optional: link SAST gate to pipeline pack from M3.
Command guide
Try these commands — Lab contract: SAST and secrets pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Bridgecrew Checkov — https://www.checkov.io/ CISA Secure by Design — https://www.cisa.gov/securebydesign NIST SSDF PW.4 — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install checkov
macOS:
Command — copy this
pipx install checkov
Windows:
Command — copy this
pip install checkov
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/iac-scan-lab-summary.md" <<'EOF'
# IaC Scan Lab Summary — YOUR lab
- main.tf: intentional S3 + SG misconfigs (never apply to real AWS)
- checkov -f main.tf — document FAILED checks
- Remediation literacy: enable public access block; restrict SG CIDR
## Refusals
- No terraform apply on stranger accounts; scan YOUR files only
EOFCommand — copy this
grep -E 'main.tf|Refusals|Remediation' "$DEVSEC_LAB/notes/iac-scan-lab-summary.md" grep -E 'aws_s3|aws_security_group' "$DEVSEC_IAC/main.tf" ls "$DEVSEC_IAC/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/iac/main.tf | Select-String MISCONFIG Get-Content $HOME/cyberlium-lab/t36-devsec/notes/checkov-named.txt | Select-String checkov
Primary tools to practice this lesson: grep, checkov. Reference sites: Bridgecrew Checkov (https://www.checkov.io/); CISA Secure by Design (https://www.cisa.gov/securebydesign); NIST SSDF PW.4 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for live API keys, stranger org repo URLs, production PATs — remove. Confirm all secrets are $DEVSEC_LAB placeholders.
SAST examples use fictional vulnerable patterns — no real exploit targets.
3. Lock the proof
chmod 600 on the pack. Quiz next — then DAST Named.
SAST literacy feeds DAST lessons in M5.
4. What you ship: SAST and secrets pack for $DEVSEC_LAB
Merged SAST, Gitleaks, hygiene sections. $DEVSEC_LAB named. NO stranger scans. chmod 600.
5. What you record before the next lesson
Date. SAST pack path. $DEVSEC_LAB named. File t36-m04-l04-sast-lab.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include live AWS keys in pack. Skip Gitleaks section.
Right
Write YOUR SAST and secrets pack for $DEVSEC_LAB. chmod 600. Next: Quiz — SAST and Secrets.
Mission: freeze YOUR SAST and secrets pack on disk
1) Merge M4 literacy sections. 2) Confirm placeholder secrets only. 3) Link M1/M3 cross-refs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed SAST pack beats scanning stranger orgs without scope.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: SAST pack should include severity gate examples.
True or False
Knowledge Check
APPLY: SAST pack supports:
Multiple choice